OAuth client secrets
Create an OAuth secret and attach it to an authentication, disclosure, or issuance flow.
Use an OAuth client secret when your server authenticates to Ver.iD. Public authentication and disclosure clients can use authorization code with PKCE without a secret. Production issuance requires a server-side client with a secret.
Create the secret
- In Ver.iD Studio, open Clients → OAuth. This opens the Secrets page.
- Click Create secret and enter a name that identifies the integration.
- Set Type to OAUTH and click Create secret.
- Open the created secret and its Settings tab.
- Copy Key (as base64url). This is the client secret value; copy it exactly as shown.
Attach it to a flow
You can create the secret before the flow exists. Create or open the flow in Studio:
| Flow | Studio location | Setup guide |
|---|---|---|
| Authentication | Verify → Authentications | Create an authentication |
| Disclosure | Verify → Disclosures | Create a disclosure |
| Issuance | Issue → Issuances | Create an issuance |
- If the flow is active, click Deactivate so you can edit it.
- Open Secrets → Add secret.
- Select OAUTH, choose the secret you created, and click Add secret.
- Activate the flow after completing its other settings.
Creating the secret makes it available to your organization. Attaching it to the flow makes it available for that flow's client authentication.
Use the correct values in your client
| Client setting | Value in Studio |
|---|---|
| Client ID | The flow's client identifier under Configuration |
| Client Secret | Key (as base64url) from the attached secret |
The secret's Key identifier identifies the secret record. Use the separate Key (as base64url) value for client authentication.
Store that value in your server-side client's secret configuration. For the Keycloak integration, enter it in the Ver.iD identity provider's Client Secret field.